Welcome back to XML external entity session. In
this second part. We will exploit our intentionally, vulnerable
application to get access to some sensitive data.
We will jump straight to the ends on exploitation,
and then move on to the mitigation parts.
We should look for some upload feature so that we can upload the malicious
XML file. Let's see, what features Anonymous users
have access to.
The customer feedback form does not allow any bloats and
is anonymous users. We don't have that much features. Let's
sign up for a regular user account.
Okay, let's check the same features, but now is authenticated
users.
Customer feedback form Remains the Same.
Complaint is a new feature.
And this time it looks like we will be able to upload some files. Let's
prepare something.
This is our militias XML file. We
declare an external entity xxe whose
content should be loaded from a specific file. This
file is where Linux system store user account information. If
XML files are allowed and processed by a vulnerable XML
processor, then it should load a file and replace
our entity inside the message tag by its content.
Let's open developer tools so that we can inspect Network traffic.
Apparently XML is not an expectable upload format,
but let's see what happens.
We've got an error message. Let's inspect it.
The request includes our XML file content and
response shows an error message.
It looks like our XML file content is partially returned
as part of, their her message.
Inside the message tag. We have the content of
the passwd file. Let's
see what else we can get from the system.
Fingerprinting, the operating system can be interesting.
Again, the same HTTP error response.
We also get the same error message, including our
XML file content and information
about the operating system. Jewish drop is running gun.
We could keep going Gathering contents from the server, but
let's move forward.
In the third. And last part of the session, we will discuss XML
external, entities, mitigation.